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Ill 

Specification 

1. Title of the invention: Control device for vehicles 
[Abstract] 

[Purpose] To provide a control device for vehicles which can 
significantly improve security and protection and minimize the 
time wasted on disorder recovery without performing unnecessary 
security operation at the time of initial write-in of the 
program; also, the process of interruption process can be used 
for data transfer in the on- board rewriting operation; high speed 
and highly reliably protocol can be easily adopted; and it 
enables an on-board reloading system for vehicles configured 
inexpensively. 

[Constitution] A transfer program (15) for an on-board program 
reloading device (10) is transferred to RAM (7) within a MCU (2) , 
•and a flash ROM (4) is reloaded by the action of the transfer 
program. Prior to starting the transfer program on the RAM (7) , 
the agreement of the code (17a) provided externally and the code 
(4a)) originally on the ROM is checked. A reloading control 
means. (6) for stopping the reloading operation when disagree is 
configured within the MCU (2) . J_2 

2. Claim 

[Claim 1] In a control device for vehicles where a reprogrammable 
'Numbers in the margin indicate pagination in the foreign 

text . 



memory means stored with algorithm and data for control and a CPU 
for controlling the vehicle loading machine based on the 
algorithm and data of the memory are stored within the processing 
device and the content of the reprogrammable memory is packed so 
that it generally cannot be read from the said processing device 
externally, the control device for vehicles comprises within said 
processing device with a rewriting mode discrimination means for 
discriminating the rewriting command from external, a serial 
communication means for conducting communication with outside, a 
temporary memory for temporarily loaded with a transfer program 
loaded from external via the serial communication means at the 
initial rewriting mode, a rewriting control means for receiving 
signals of said rewriting mode discrimination means and loading 
the transfer program to said temporary memory and applying the 
control to the transfer program by the prescribed timing; it 
possesses a function of renewing the contents of said 
reprogrammable memory according to the code received externally 
via said serial transfer means by operation of said transfer 
program; the control device for vehicles characterized in that 
said rewriting control, means comprises a function of comparing a 
code received from external by the prescribed timing prior to 
applying the control to said transfer program and a code pre- 
stored in the specific address of said reprogrammable memory and 
stopping the rewriting mode when they are disagree. 
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[Claim 2] In a control device for vehicles where a reprogrammable 
memory means stored with algorithm and data for control and a CPU 
for controlling the vehicle loading machine based on the 
algorithm and data of the memory are stored within the processing 
device and the content of the reprogrammable memory is packed so 
that it generally cannot be read from the said processing device 
externally, the control device for vehicles comprises within said 
processing device with a rewriting mode discrimination means for 
discriminating the rewriting command from external, a serial 
communication means for conducting communication with outside, a 
temporary memory for temporarily loaded with a transfer program 
loaded from external via the serial communication means at the 
initial rewriting mode, a rewriting control means for receiving 
signals of said rewriting mode discrimination means and loading 
the transfer program to said temporary memory and applying the 
control to the transfer program by the prescribed timing; it 
possesses a function of renewing the contents of said 
reprogrammable memory according to the code received externally 
via said serial transfer means by operation of said transfer 
program; the control device for vehicles characterized in that 
said rewriting control means comprises a function of comparing a 
code received from external by the prescribed timing prior to 
applying the control to said transfer program and a code pre- 
stored in the specific address of said reprogrammable memory and 
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deleting the entire or partial contents of the specific address 
of said reprogrammable memory when they are disagree. 
[Claim 3] In a control device for vehicles where a reprogrammable 
memory means stored with algorithm and data for control and a CPU 
for controlling the vehicle loading machine based on the 
algorithm and data of the memory are stored wichin che processing 
device and the content of the reprogrammable memory is packed so 
that "it generally cannot be read" from the said processing device 
externally, the control device for vehicles comprises within said 
processing device with a rewriting mode discrimination mearts for 
discriminating the rewriting command from external, a serial 
communication means for conducting communication with outside, a 
temporary memory for temporarily loaded with a transfer program 
loaded from external via the serial communication means at the 
initial rewriting mode, a rewriting control means for receiving 
signals of said rewriting mode discrimination means and loading 
the transfer program to said temporary memory and applying the 
control to the transfer program by the prescribed timing; it 
possesses a" function of renewing the contents of said 
reprogrammable memory .according to the code received externally 
via said serial transfer means by operation of said transfer 
program; the control device for vehicles characterized in that 
said rewriting control means comprises a function of applying the 
control to said transfer program unconditionally without 
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comparing the code received from external by the prescribed 
timing prior to applying the control to said transfer program and 
a code pre-stored in the specific address of said reprogrammable 
memory when the content of the specific address above 1 of the 
reprogrammable memory is in the non-write-in state. 
[Claim 4] In a control device for vehicles where a reprogrammable 
memory means stored with algorithm and data for control and a CPU 
for controlling the vehicle loading machine based on the 
algorithm and data of the memory are stored within the processing 
device and the content of the reprogrammable memory is' packed so 
that it generally cannot be read from the said processing device 
externally, the control device for vehicles comprises within said 
processing device with a rewriting mode discrimination means for 
discriminating the rewriting command from external, a serial 
communication means for conducting communication with outside, a 
temporary memory for temporarily loaded with a transfer program 
loaded from external via the serial communication means at the 
initial rewriting mode, a rewriting control means for receiving 
signals of said rewriting mode discrimination means and loading 
the transfer program to said temporary memory and applying the 
control to the transfer program by the prescribed timing; it 
possesses a function of renewing the contents of said 
reprogrammable memory according to the code received externally^ 
via said serial transfer means by operation of said transfer 
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program; the control device for vehicles characterized in that an 
interruption vector region of said CPU is taken in the specific 
region within the reprogrammable memory by the normal mode and an 
interruption vector moving means is provided within the 
processing device so that the interruption vector is allowed to 
move in the prescribed region within the said temporary memory 
means only during the prescribed period in the mode in the 
rewriting mode transferred by the rewriting mode discrimination 
means . 

2. Detailed explanations of the invention 
[0001] 

[Industrial Field of Applications] 

This invention relates to a control device for 
vehicles. In particular, it pertains to an on-board reloading 
technology for control software stored in the control device for 
vehicles . 
[0002] 

[Prior Art] 

In recent years, large scaled electric reprogrammable memory 
(E 2 PROM and flash ROM) has been in practical use, and also has 
been used within the control devices for vehicles. The usage 
includes storage of control constant and storage of control 
algorithm, and it is assumed that the following convenience has 
provided. 
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[0003] 

Software bug found after the product shipped from the 

automobile maker can be easily corresponded by on-board 
rewriting by field. 

Deterioration and chronological change of the constructional 
parts of the vehicle can be corresponded by reloading the 
matching constant stored within the control device. 
"The control software matching to the configuration when the 
configuration of the control device is changed by 
attaching and detaching optional parts after product 
shipment can be reloaded. 

[0004] 

For example, the document "Cost-effective field 
reprogrammable code-flash memory technology." ) Spec Publ Soc 
Automot Eng. NO. S P - 7 3 9 PAGE . 55-59 1988) has clearly described 
regarding to (1) and (2), and Tokkai H3-149337 disclosed the 
patent application regarding to (3) . Also, the technology of 
executing reprogramming by read-in the transfer program designed 
by the user* for reprogramming to the RAM region within the one 
touch 'microcomputer upon on-board reprogram externally has 
described in documents such as "H8/53 8F hardware manual" (by 
Hitachi Plant, issued by Semiconductor Industrial Department on 
August 1993, edition 1), which is well known. 
[0005] 
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However, for the on-board reprogramming of the mode of 
reading the program for reprogram transfer from external and 
applying the control to it, it is not the standard reprogram, and 
the possibility of loading false program for the internal 
information output is inevitable. . Also, since the creation 
method for transfer program for reprogram is generally open to 
the public, everyone can create transfer program for 
reprogramming freely. As a result, anyone can easily falsify the 
internal code by using a false program. 
[0006] 

For the system permitting reprogramming of the control 
software and constant by field, the preservation of security of 
the code and protection of the code from the reprogramming 
(falsify) other than legal operation become important objects. 
For example, regarding to the EPROM attached outside, a control 
system is well known that a check data is created based on the 
data of the external memory by the prescribed timing, the check 
data and the check data in the internal memory are compared, and 
the abnormality mode is set up as the falsifying of the data of 
the external memory when both are not match (for example, refer 

to Tokkai H3-238541) . 

[0007] 

[Problems that the Invention is to Solve] 

However, the technology for preserving security of the code 
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and protecting the code from reprogram (falsify) other than 
regular operation has not developed for one-chip microcomputer 
for vehicle loading of built in large scale E 2 PROM and flash 
ROM. 
[0008] 

Also, when the transfer program for reprogramming created by 
the user is loaded within the one-chip microcomputer from ■ 
external and -reprogramming is performed, the problem is that the 
freedom to the algorithm of the reprogramming program is 
minimized. For example, the interruption vector is normally 
mapped in the address space on the flash ROM to be reprogrammed, 
and the reprogramming operation cannot use the interruption 
process . 
[0009] 

Taking into consideration of these problems, the purpose of 
this invention is to provide a control system for vehicles which 
can significantly improve security and protection and minimize 
the time wasted on disorder recovery without performing 
unnecessary" security operation at the time of initial write-in of 
the program; also, the process of interruption process can be 
used for data transfer in the on-board rewriting operation; high 
speed and highly reliably protocol can be easily adopted; and it 
enables an on-board reloading system for vehicles configured 
inexpensively. 
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[0010] 

[Means for Solving the Problems] 

In order to attain the aforementioned purpose, basically, 
for a control device for vehicles where a reprogrammable memory 
means stored with algorithm and data for control and a CPU for 
controlling the vehicle loading machine based on the algorithm 
and data of the memory are stored within the processing device 
and the content of the reprogrammable memory is packed so that it 
generally cannot be read from the said processing device 
externally, the control device for vehicles comprises within said 
processing device with a rewriting mode discrimination means for 
discriminating the rewriting command from external, a serial 
communication means for conducting communication with outside, a 
temporary memory for temporarily loaded with a transfer program 
loaded from external via the serial communication means at the 
initial rewriting mode, a rewriting control means for receiving 
signals of said rewriting mode discrimination means and loading 
the transfer program to said temporary memory and applying the 
control to the transfer program by the prescribed timing; it 
possesses a function of renewing the contents of said 
reprogrammable memory according to the code received externally 
via said serial transfer means by operation of said transfer 
program; the control device for vehicles characterized in that 
said rewriting control means comprises a function of comparing a 
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code received from external by the prescribed timing prior to 
applying the control to said transfer program and a code pre- 
stored in the specific address of said reprogrammable memory and 
stopping the rewriting mode when they are disagree. Zi 
[0011] 

As preferable concrete examples of this invention, the 
control device for vehicles characterized in that said rewriting 
control means comprises a function of comparing a code received 
from external by the prescribed timing prior to applying the 
control to said transfer program and a code pre -stored in the 
specific address of said reprogrammable memory and deleting the 
entire or partial contents of the specific address of said 
reprogrammable memory when they are disagree. The control device 
for vehicles characterized in that said rewriting control means 
comprises a function of applying the control to said transfer 
program unconditionally without comparing the code received from 
external by the prescribed timing prior to applying the control 
to said transfer program and a code pre-stored in the specific 
address of said reprogrammable memory when the content of the 
specific address above 1 of the reprogrammable memory is in the 
non-write-in state. 
[0012] 

A preferable working example is that the interruption vector 
region of said CPU is taken in the specific region within the 
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reprogrammable memory by the normal mode and an interruption 
vector moving means is provided within the processing device so 
that the interruption vector is allowed to move in the prescribed 
region within the said temporary memory means only during the 
prescribed period in the mode in the rewriting mode transferred 
by the rewriting mode discrimination means. 

[0013] 

[Function] 

As described above, for the control system for vehicles of 
this invention with the aforementioned configuration, by using 
the knowledge only known by the initial code designer of the one- 
chip microcomputer as the check code, false program access can be 
prevented. In other words, the internal code can be deleted and 
the confidentiality can be protected during false program access. 
Also, during initial code write-in, the time and labor required 
for block-out recovery can be minimized so that the unnecessary 
check operation can be eliminated. Furthermore, creation of the 
transfer program for reprogram by the user is made easier. 
[0014] 

[Working examples] 

A working example of this invention is described by diagrams 
in the following. FIG. 1 is a block diagram of a control system 
for vehicles of a working example of this invention. A MCU 
(Micro Control Unit) 2 is soldered to the substrate inside the 
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control system 1 for vehicles. A CPU (Central Processing Unit) 3 
in the MCU 2 performs control of the machine by command of the 
program stored in the flash ROM 4 which is a reprogrammable 
memory. Normally, the content of the flash ROM 4 is hidden in 
the resin packing called MCU 2, and cannot be easily read from 
outside. Therefore, the security and protection of the program 
can be sustained by this function. 
[0015] 

An on-board program re-programmer 10 is connected with the 
MCU 2 by a serial line RX 11 and a serial line TX 12, and 
performs reprogramming of the aforementioned program from 
outside. Generally, the MCU 2 is not taken out from the 
substrate of the automobile control system 1. This mode of 
reprogramming the internal program by the form of mounting as is 
called as "on board program reprogram." Since it can be done 
without taking out the MCU 2 from the substrate, the time and 
cost required for replacement can be significantly reduced . 
without effecting its electrical reliability compared with the 
format of EPROM exchange and asshi exchange such as the substrate 
and unit. 
[0016] 

The principle of the "on board program reprogramming" is 
described in the following. An external switch 13 transfers a 
command of program reprogramming from external to the MCU 2. It 
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differs by the internal mechanism of the MCU 2, however, 
normally, it is performed by applying the write-in voltage Vpp 

(12V) to the prescribed terminal of the MCU 2 and releasing the 
reset. The reprogramming mode discrimination means 5 
discriminates the aforementioned signal and transfers the MCU 2 
to the state of reprogramming mode. 

[0017] 

'In the reprogramming mode, 'the CPU 3 is operated by the boot 
program stored in the reprogram control means 6, which is not 
operated by the ordinary control program stored in the 
reprogrammable memory 4. Data exchange with outside is made 
possible by this function via the SCI 8 (Serial Communication 
Interface) . On the other hand, the on board program reprogrammer 
10 is configured by a SCI 14 similar to the MCU 2, a 
reprogramming transfer program 15 for transferring to the 
temporary memory 7 (RAM) within the MCU 2, the exchangeable 
recording media 17 stored with the code as the renewal content of 
the reprogrammable memory 4 as the final result, and the 
communication control means 16 for controlling the flow of the 
data. 
[0018] 

The aforementioned exchangeable recording media 17 could be 
in the forms of electric element such as EPROM, magnetic 
recording media such as floppy disk, or terminal device such as 
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keyboard. The MCU 2 transferred to the reprogramming mode 
transfers the reprogramming transfer program 15 to the temporary 
memory 7 via the serial line RX 11. Then, the control of CPU 3 
is switched over to the transfer program for reprogramming on the 
temporary memory 7. 
[0019] 

The reprogramming transfer program is then continuously read 
in the code of the exchangeable ■ recording media 17 of the on 
board program reprogrammer 10 via the serial line RX 11, and the 
content of the reprogrammable memory 4 is renewed. The serial 
line TX 12 is used for controlling of flow of the serial 
communication. For example, it is used for reception 
confirmation signal and data retransfer command from the MCU 2 to 
the on board program reprogrammer 10. 13. 
[0020] 

If the transfer program 15 for reprogramming is stored in 
advance as the firmware in the reprogramming control means 6 
within the MCU 2, it is efficient since it. can be done without 
transfer to" the MCU 2 by an on board program reprogrammer 10 in 
the initial stage of the reprogramming mode. However, this 
method cannot be adopted because the following reasons. 
The firmware of the reprogram control means 6 becomes large in 

scale and the cost increases (worked as' hard as possible to 

set a simple boot program) . 
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The communication between Che on board program reprogrammer 10 
and the MCU 2 and the reprogramming algorithm of the 
reprogrammable memory 7 are fixed, and there is no 
flexibility. (the user cannot take charge according to TPO.) 
[0021] 

Also, it is not required if the reprogram transfer program 
15 is placed in the reprogrammable memory 4. However, this 
method also cannot be adopted because the following reasons. 
The system for the initial reprogramming and the reprogramming 

thereafter must be different. (The transfer program is not 

existing in the non- reprogramming state.) 
The transfer program for reprogramming itself must be modified 

externally. 

The memory block loaded to the transfer program for reprogramming 

cannot be deleted .. 
It is troublesome to set and manage the control program of the 

control device 1 for vehicles and the transfer program for 

reprogramming simultaneously. 
[0022] 

The check code 17a contained in the exchangeable recording 
media 17 is transmitted to the MCU 2 by the prescribed timing via 
the serial line RX 11. The prescribed timing could be anytime 
before the reprogramming control means 6 within the MCU 2 
transfer the control of the CPU- 3 to the reprogramming transfer 
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for solving the drawbacks. The interrupting vector region is 
allowed to move to the region 7b within the temporary memory 7 
during the operation of the transfer program for reprogramming on 
the temporary memory 7 by the reprogramming mode. Therefore, the 
interrupting function can be utilized by the transfer program for 
reprogramming, and the freedom of the algorithm is increased. 
FIG. 2 shows the algorithm by a working example of this invention 
by a flowchart. The algorithm, ' as mentioned above, is executed 
by the boot program implemented by the boot program implemented 
to the reprogramming control means 6. 
[0025] 

When the boot program of the reprogramming control means 6 
is started by receiving a signal of the reprogramming mode 
discrimination means, first, advance to the block 201, then 
synchronous process with the external on board program 
reprogrammer 10 is carried out. Synchronous processing includes 
matching of the transfer rate of the on board program 
reprogrammer 10 with MCU 2 and the confirmation process of 
communication protocol. Then advance to the block 202, and the 
total number of byte of transfer program that must be received is 
received. Then, the transfer program is copied to the temporary 
memory 7 from outside in every byte by the blocks 203, 204, and 
205 forming the loop. The loop is continued until the entire 
transfer program is being copied-. Next, the process is advanced 
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to block 206, and the check code transferred, from the on board 
program reprogrammer 10 is received. The check code 17a and the 
prescribed code 4a on the reprogrammable memory 4 are compared in 
the block 207, advance to the block 208 if matches, and transfer 
the control to the program on the temporary memory 7 which has 
just transferred. If they do not match, the reprogramming mode 
is finished by the block 209, and the protection of the code on 
the reprogrammable memory 4 is performed. 
[0026] 

Improvement of security and protection of the program can be 
realized according to this working example. However, for the 
aforementioned algorithm, if reprogramming operation is executed 
to the entire code pattern which can be taken by the prescribed 
code 4a, the protection is broken down sometime. Another working 
example showing improvement of this aspect is shown in the 
flowchart in FIG. 3 . 
[0027] 

FIG. 3 is a block diagram exactly identical with FIG. 2 
except the block 207' reversed with the logic with the block 207 
in FIG. 2 and the newly added block 210. Therefore, in the 
flowchart in FIG. 3, the same number is marked to the block 
corresponding to the block of FIG. 2, and repeated description is 
omitted. In the following, description is emphasized exclusively 
on the difference with FIG. 2. 
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[0028] 

In the block 207', the check code 17a transferred by the on 
board program reprogrammer 10 and the prescribed code 4a on the 
reprogrammable memory 4 are compared. If they match, identical 
with FIG. 2, switch the control to the transfer program. If they 
do not match, the entire or a portion of the code on the 
reprogrammable memory 4 is deleted and the confidentiality is 
kept . 
[0029] 

In the algorithm of this working example, the method of the 
aforementioned trial and error protection releasing is not used. 
Security of the system is improved. Therefore, since the code is 
unconditionally removed when matching of the check code is 
failed, therefore, there is a risk of that the code is rewritten 
from one again. As a countermeasure of this point, the algorithm 
can be changed so that the program is deleted only when matching 
of the check code failed the prescribed number of times. 
[0030] 

Also, as described above, matching of the check code is 
performed after fetching in the transfer program for 
reprogramming, but it can also be performed before fetching in 
the transfer program. Next, a flowchart according to another 
working example of this invention is shown in FIG. 4. FIG. 4 is 
a diagram based on FIG. 3 where- the block 211 is added. The same 
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number is marked to the block corresponding to FIG. 2 and FIG. 3. 
The operations differ with FIG. 3 is described exclusively in the 
following . 
[0031] 

After fetching in the transfer program for reprogramming, if 
the prescribed address of the reprogrammable memory 4 is in the 
non-write-in state, then continuously skip the check code 
matching by the block 211. The algorithm only performs the 
necessary initial write-in operation of MCU 2, thus throughput 
.can be improved. 
[0032] 

On the other hand, for example, the prescribed address 
discriminating the unwritten state by the block 211 is matched 
with the aforementioned code 4a- In the initial stage of the 
transfer program for the aforementioned reprogramming, the 
prescribed address is in the unwritten state. The check code is 
set up by providing to the next reprogramming in the prescribed 
address. Thus, the signal is shared for whether or not the check 
code is succeeded in the complete reprogramming. As a result, in 
the middle of program^ reprogramming , if any disorder occurred in 
the serial line, or the reprogramming control hanged up, the 
reprogramming program is not being deleted in the middle by 
operation of the aforementioned algorithm. Therefore, the 
reprogramming operation can be -continued by memory block with 
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unfinished reprog ramming, and the time required for block-out 
recovery is shortened. 
[0033] 

Next, a time chart of a conventional transfer program for 
reprogramming without using" an interrupting function is indicated 
in FIG. 5 for the purpose of comparison with the working example 
of this invention. When one byte is received by the on board 
program reprogrammer 10 in the period of 501, the code of the 
reprogrammable memory 4 is renewed by the data in the immediately 
following period 502. A signal regarding the matter of 
capability of the following receiving is output on the serial 
communication line TX 12 in the continuing period 503. In the on 
board program reprogrammer 10, this signal is recognized, the 
next data is transferred in the period 504, and transfer per byte 
is performed by the hand shake operation. 
[0034] 

The algorithm is shown in FIG. 6 in the form of flowchart. 
In this flowchart, since the error detection of the received data 
and retransfer function are complicated, they are removed from 
the flowchart. In the block 601, the data from the on board 
program reprogrammer 10 is received, and the data is renewed in 
the block 602. If the entire program code that must be 
reprogrammed by the next block 603 is completely received, 
transfer is finished in 605. If there are codes remaining to be 
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received, return to the sending back block 601 so that the next 
receiving becomes possible in the block 604. 
[0035] 

The conventional method has the following drawbacks. 
The receiving operation and write-in operation for the data 

cannot be performed synchronously as multitasking. Therefore, 
. hand shake operation per each byte must be performed between 
the on board program reprogrammer 10 and the MCU 2. Thus, the 
transfer throughput is impossible to increase. 
If the signal showing capability of receiving data, for example, 
the data 505 in FIG. 5, disappeared by noise on the serial 
line, the hand shake operation stops there and is impossible 
to continue. Also, there is no means for recognizing this 
phenomenon for the transfer program for reprogramming . 
[0036] 

In order to solve these programs, the result of improving 
the operation by using the receiving interrupting and timer 
interrupting according to the working example of this invention 
is shown in the time chart in FIG. 7. In FIG. 7, the data is 
gathered and sent in 4 bytes each by using the receiving 
interrupting. Also, the receiving operation and write-in 
operation are performed synchronously as multitasking, the 
transmission of the receivable signal 701 is thinned to 1 byte in 
receiving data 4 bytes. The transfer timing of the receivable 
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signal 701 can be thinned to the size of the data reception 
buffer in principle. Therefore, it is clear that the transfer 
throughput can be greatly improved. 
[0037] 

Also, after sending out the receivable signal 701, then waic 
for whether or not the next receiving data is transferred during 
the period T shown in the diagram. If it is not sent out, it is 
regarded as the receivable signal 701 disappeared on the line, 
and the receivable signal 702 is retransmitted (it is called time 
out process) . The reliability of data transfer can be 
significantly improved. U- 
[0038] 

FIG. 8 is a flowchart of the above algorithm. The error 
detection and retransmission function for the receiving data is 
complicated, and they are removed from the flowchart in this 
flowchart. Blocks 820 through 823 show the process routine for 
receiving interruption. In the block 820, the timer interrupting 
permitted in the block 810 is prohibited, and the time out 
process is prevented from occurring. In the blocks 821 and 822, 
the data which is the_ interrupting factor is received and stored 
in the reception buffer in sequence. In the following block 823, 
the number of byte actually stored in the reception buffer is 
counted as the variable "n" . 
[0039] 
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On the other hand, in the block 801 for the reprogramming 
transfer program, whether or not data is existing in the 
reception buffer is checked. If it does not exist, then wait by 
the loop. If it exists, write in is performed by read-out from 
the buffer in the following blocks 802 and 803. . In the following 
block 804, the data number read out from the reception buffer is 
counted by the variable «m« . In the block 805, if there are data 
not being read out in the buffer, then return to the block 802 
and perform discrimination. In the following block 806, whether 
or not the data number stored in the reception buffer is the 
regulated number of byte is checked. The regulated number of 
byte refers to the number of data sent from outside at one time, 
and it depends to the size of the reception buffer (it is 4 for 
the case of FIG. 7). If it reached to the regulated number of 
byte, then advance to the block 807. If it did not reach to the 
regulated number of byte, then form a loop with the block 805 
immediately before, and wait for the data to store in the 
reception buffer by the reception interrupting process. In the 
block 807, whether or not the entire code that must be is 
reprogrammed is finished receiving is checked. If the reception 
is completed, then skip and finish in 811. Also, if the code 
that must be received is remaining, then clear the variable "n" 
and "m" in the block 808, and return the matter the next 
receiving is possible in the block 809. In the block 810, the 
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timer interrupting for time out processing is activated in the 
block 810, and return to the block 801. 
[0040] 

As shown in FIG. 7, when the period T is passed, the block 
830 for the timer interrupting process is started, and the 
receivable signal is retransmitted if receiving is not carried 
out even one byte . 
[0041] 

[Effectiveness of this invention] 

It is clear from the above description that with this 
invention, a control device for vehicles which can significantly 
improve security and protection and minimize the time wasted on 
disorder recovery without performing unnecessary security 
operation at the time of initial write-in of the program; also, 
the process of interruption process can be used for data transfer 
in the on-board rewriting operation; high speed and highly 
reliably protocol can be easily adopted; and it enables an on- 
board reloading system for vehicles configured inexpensively. 
4. Brief Description of the Diagrams 

FIG. 1 is internal block diagram showing a working example 
of this invention. 

FIG. 2 is a flowchart showing a working example of this 

invention. 

FIG. 3 is a flowchart showing another working example of 
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this invention. 

FIG. 4 is a flowchart shewing another working example of 

this invention. 

FIG. 5 is a cirne chart of a conventional transfer program. 

FIG. 6 is a flowchart of a conventional transfer program. 

FIG. 7 is a time chart of a transfer program of this 
invention . 

FIG. 8 is a flowchart of a transfer program of this 
invention . 

.[Description of numbers] * 
1... control system for vehicles, 2... one-chip microcomputer as MCU, 
3... CPU, 4... flash ROM as the reprogrammable means, 6... boot program 
firmware as the reprogram control means, 7... RAM as the temporary 
memory, 10... on board reprogrammer , 11, 12... bidirectional serial 
communication line, 15... transfer program for reprogramming , 17... 
EPROM as the exchangeable recording media. 
FIG. 5 

1... receiving operation, 2... write-in operation, 3... transmission 
operation. 

FIG. 2 

A. Boot program start, 201... synchronous confirmation process, 
202... receive "n" number of byte of transfer program, 203... 
receiving transfer program, 204... store in the temporary memory 7 
(RAM), 205... It the number of receiving byte = n? 206.- receive 
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check code 17a, 207... (not match) Is the code 17a = code 4a? 208... 
Jump to the transfer program on RAM , 20 9... finish the 
reprogramming mode . 
FIG. 3 

A. Boot program start, 201... synchronous confirmation process, 
202... receive "n" number of byte of transfer program, 203... 
receiving transfer program, 204... store in the temporary memory 7 
(RAM) , 2 05... It the number of receiving byte = n? 2 06... receive 
check code 17a, 207... (match) Is the code 17a = code 4a? 210... (not 
match) delete the reprogrammable memory 4, B. Jump to the 
transfer program on RAM 
FIG. 4 

A. Boot program start, 201... synchronous confirmation process, 
202... receive "n" number of byte of transfer program, 203... 
receiving transfer program, 204... store in the temporary memory 7 
(RAM) , 205... It the number of receiving byte = n? 211... Is the 
prescribed address of the reprogrammable memory 4 "unwritten?" 
206... receive check code 17a, 207... (match) Is the code 17a = code 
4a? 210... (not match) delete the reprogrammable memory 4, B. Jump 
to the transfer program on RAM 
FIG. 6 

A. Transfer program for reprogramming, 601... receive 1 byte, 602... 
write in 1 byte into the reprogrammable memory 4, 603... The 
prescribed receiving byte number? Receivable signal transmission, 
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605... finish. 
FIG. 7 

1... receiving interrupting, 2... timer interrupting, 3... receiving 
operation, 4... write-in operation, 5... transmission operation 
FIG. 8 

A. Transfer program for reprogramming, 8 01... n ? 0? 802... read out 
1 byte from the receiving buffer, 803... read in 1 byte to the 
reprogrammable memory 4, 804... [illeg.] - m + 1, 805... m < n? 806... 
n = (the regulated number of receiving byte) ? 807... the prescribed 
receiving byte number? 808... n <- 0 m <- 0, 809... receivable signal 
transmission, 810... timer interrupting permission after the time 
"T" , 811... finish, 820... timer interrupting prohibiting, 821... 1 
byte receiving, 822... write in 1 byte in the receiving buffer, n 
<- n +1, B. timer interrupting, 830... receivable signal 
retransmission, C. reception interraption . 
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